NHS sends confidential patients' records to India despite pledges it would not

The NHS is sending millions of patient records to India for processing, it emerged yesterday.

In the latest privacy scandal to hit the Health Service, Indian data entry staff will have access to the names, addresses and NHS numbers of patients - along with private information about medical appointments.

Managers have given the green light to the scheme despite concerns over poor security at some Indian companies.

Lib Dem MP and IT expert John Hemming: 'Given the government's track record of losing data in this country, it is worrying that data are being sent overseas'

Seven primary care trusts in north east London, serving more than 1.5million people, have started to send the information to a data entry firm in Pune, western India, where it will be inputted by 200 workers.

This is despite a pledge from the Department of Health that no personal information would be sent overseas.

John Hemming, the Lib Dem MP for Birmingham Yardley and an expert on IT, said: 'Given the government's track record of losing data in this country, it is worrying that data are being sent overseas. Every transfer of information adds to the risk of being lost.'

Critics of the scheme say there is a risk that patients could be identified if NHS numbers are matched with anonymised clinical notes which are already being sent to India by more than 30 trusts.

These clinical notes are transcribed in India from recordings made on consultants' dictaphones during or after an appointment.

Even though they are meant to be anonymised, patient names can crop up during the appointment and are then transcribed by the Indian staff.

Workers in India are also producing letters for patients with appointments for cervical smears and breast screenings.

The first data was sent abroad in 2006 when pilot schemes first started. Since then, NHS offshore transcription services have rapidly expanded. The Royal Free hospital in London, the Derby hospitals trust and the Newham University hospital trust are among those sending clinical notes overseas.

Three years ago, the then health minister Caroline Flint told parliament that the government's NHS IT programme would 'expressly preclude the transfer of patient information outside the United Kingdom'.

But it appears some trusts have taken the view that Ms Flint was only talking about information which is strictly part of the £12billion scheme to computerise patient records.

They say patient data can be sent abroad if they are not part of this electronic records project.

The risks of transferring data overseas were highlighted last year when undercover reporters for a TV programme were able to buy health records from a private London hospital, which had been processed in India. The sellers said they had access to thousands of British medical records.

The transfer of records at the seven PCTs is being handled by NHS Shared Business Services, a joint venture between the DoH and Steria, an IT company.

A spokesman said the data did not include confidential clinical records - just patients' names, NHS numbers and home addresses. He said security was very strict in Pune and the company complied fully with data protection laws.

Waltham Forest PCT, one of the seven, said it took 'all appropriate security measures' to protect patients' information.

Last month doctors' leaders said patient records were being put on a controversial NHS online database without their knowledge or consent.